Antoine Roly
@aroly.bsky.social
Hacker, Bug Bounty Hunter, Pentester,... From Namur, BE.
90 minutes till "Can AI do novel security research? Meet the HTTP Terminator" kicks off at #DEFCON main stage 3! Watch the live-stream here at 1200 PDT www.youtube.com/watch?v=9go8...
DEFCON 34: Track 3 Talks
YouTube video by DEFCONConference
youtube.com
I'm thrilled to announce "Can AI Do Novel Security Research? Meet the HTTP Terminator" will premiere at Black Hat USA! Check out the abstract: blackhat.com/us-26/briefi...
I wrote a blog post about how I use Claude Code (and other models) in my work: invicti.com/blog/securit...
Security Research in the Age of AI Tools
Learn how AI tools can support security researchers in investigating vulnerabilities and designing security checks to detect them.
invicti.com
“We should have banned government use of face recognition when we had the chance because it is dangerous, invasive, and an inherent threat to civil liberties,” EFF’s @MGuariglia.bsky.social told @404Media.co. www.404media.co/ice-and-cbp...
ICE and CBP Agents Are Scanning Peoples’ Faces on the Street To Verify Citizenship
Videos on social media show officers from ICE and CBP using facial recognition technology on people in the field. One expert described the practice as “pure dystopian creep.”
404media.co
« On est en train de discuter des livres que va lire Nicolas Sarkozy en prison ? Alors qu'il a été condamné pour "association de malfaiteurs". » @fabricearfi.bsky.social Journaliste d’investigation La suite : ⏰ 22h50 sur france·tv ➡️https://bit.ly/SarkozyEnPrisonHonneurDeshonneur 🎧en podcast
I’m excited to announce that I’ll be presenting The Fragile Lock: Novel Bypasses for SAML Authentication at Black Hat Europe! In this talk, I’ll show how I was able to continuously bypass security patches to achieve complete auth bypass for major libraries. #BHEU @blackhatevents.bsky.social
Je lance une bouteille à la mer ... Les @restosducoeur 💞cherchent beaucoup d’ordinateurs portables et tiny (Linux friendly 🐧). Si votre entreprise a du stock dormant ou autre, ça nous aiderait beaucoup ! Repost apprécié :)🫶🏻
In case you missed it, AWS updated its policy about pentesting, and "Amazon API Gateway" (used by the extension "IP Rotate") isn't allowed anymore aws.amazon.com/fr/security/...
Penetration Testing
Request a penetration test for your AWS cloud infrastructure here.
aws.amazon.com
🚨NEW: "The Late Show with Stephen Colbert" just dropped its first response to ABC, FCC chair, and Disney firing Jimmy Kimmel. Trump ain't sleeping tonight. 🤣 This is a must-watch. 🔥
We've just published a novel technique to bypass the __Host and __Secure cookie flags, to achieve maximum impact for your cookie injection findings: portswigger.net/research/coo...
Cookie Chaos: How to bypass __Host and __Secure cookie prefixes
Browsers added cookie prefixes to protect your sessions and stop attackers from setting harmful cookies. In this post, you’ll see how to bypass cookie defenses using discrepancies in browser and serve
portswigger.net
1st time I start Burp to do bug bounty since the begining of June. Let's see if I still enjoy it or if I need more time to get back at it...
How to make $$$ from request smuggling Step 1) Pick the right target:
Euro de basket : les Belgian Cats brillent face à l’Allemagne et filent en demi-finale (83-59) www.lesoir.be/684043/artic... #belgiancats
Euro de basket : les Belgian Cats brillent face à l’Allemagne et filent en demi-finale (83-59)
L’équipe nationale féminine belge de basket a poursuivi sur la lancée de son excellent début de tournoi ce mercredi. Une victoire qui leur permet de rejoindre l’Italie en demi-finale.
lesoir.be
"Ce qu’on est en train de vivre aujourd’hui, c’est les trajectoires qu’on avait imaginées il y a 20 ans. La communauté des climatologues n’est pas du tout surprise par la vague de chaleur qui arrive. Elle est effrayée." @cassouman40.bsky.social ce matin sur @franceinfo.fr #VagueDeChaleur #DontLookUp
I'm thrilled to announce "HTTP/1 Must Die! The Desync Endgame" is coming to #DEFCON33! This talk will feature multiple new classes of desync attack, mass exploitation spanning multiple CDNs, and over $200k in bug bounties. See you there!
Mais putain 🤦 Enfin, au moins on sait pour qui ils roulent...
RTBF info@rtbf-info.be · last yr.Sécurité sociale : les tranches salariales supérieures à 340.000 euros seront exonérées de cotisations patronales
Bye bye full time bug bounty hunting. It's been a hell of a ride, but it's time to move on...
AppSec Ezine - 589th edition #AppSec #Security pathonproject.com/zb/?33afd768...
AppSec Ezine
pathonproject.com
Active Scan++ just got sharper - we’ve added new checks for OS command injection, powered by our latest ASCII Control Characters research. Install via Extensions -> BApp Store
No clue if this will be exploitable, but it's at least interesting: when I add an incorrect "X-Forwarded-Port" header using HTTP Request Splitting (CRLF injection with Nginx proxy), I trigger a HTTP 400 and I can then tunnel other HTTP1 requests to the backend. Poke @t0xodile.com for the tunneling
I often end up testing weird things, but my current test is so weird that @burpsuite.bsky.social can't even handle in propery if I use the Repeater custom action 😅
Thrilled to finally release my latest research "The Single-Packet Shovel: Digging for Desync-Powered Request Tunnelling". Desync vulnerabilities stemming from HP2 downgrading continue to plague even the largest vendors, have a read to find out how!
The Single-Packet Shovel: Digging for Desync-Powered Request Tunnelling
In this paper I will reveal the discovery of wide-spread cases of request tunnelling in applications powered by popular servers including IIS, Azure Front Door and AWS' application load balancer inclu...
assured.se
If you’re into bug bounty hunting and like finding weird XSS bugs (like me 😊) in places most people overlook, come check out my talk at NahamCon 2025 this Friday, May 23. "Widgets Gone Wild: Exploiting XSS Through Flawed postMessage Checks"
I'm a big fan of these issues, but I always struggle to actually exploit them 😅
